Updated October 2, 2026: CISA issued Emergency Directive 25-03 on September 25, 2025 to address potential compromise of Cisco devices. For operators, the priority is matching the exact device, software and configuration to current vendor guidance—not assuming every Cisco product has the same exposure.
What CISA announced
CISA’s September 25, 2025 bulletin identifies Cisco ASA and Firepower devices and says CVE-2025-20333 and CVE-2025-20362 were added to its Known Exploited Vulnerabilities Catalog. The emergency directive applies to Federal Civilian Executive Branch agencies; other organizations should assess their own exposure and applicable obligations.
The CVE descriptions corrected
- CVE-2025-20333: Cisco identifies a VPN web-server remote code execution vulnerability, with a CVSS base score of 9.9.
- CVE-2025-20362: Cisco identifies a VPN web-server unauthorized-access vulnerability, with a CVSS base score of 6.5.
- CVE-2025-20363: Cisco separately lists an HTTP-server remote code execution vulnerability scored 9.0. Do not treat its exposure conditions or exploitation status as interchangeable with the other two.
See Cisco’s event-response page and advisory table for current references. The earlier article reversed descriptions and supplied incorrect scores.
Check exposure before choosing a change
Collect the model, software release, management method, enabled VPN services, support status and operational owner. Store that inventory securely. Then compare it with the affected-product and fixed-release sections of the relevant Cisco advisories. Do not copy a software version from another organization’s change plan without confirming that it applies to your platform.
Cisco connects the activity to the actor behind ArcaneDoor and describes observed persistence on specific older platforms without Secure Boot. That finding should not be generalized into a claim that every affected device retains malware after every upgrade.
Separate patching from incident recovery
Installing a corrected release and recovering a compromised system are different tasks. If compromise is suspected, preserve evidence and use the vendor’s recovery instructions with your incident-response team. Cisco’s event-response guidance addresses configuration trust and credential replacement as part of recovery.
Before maintenance, document the approved target release, configuration dependencies, service impact and recovery contacts. Verify the installed version afterward, confirm intended VPN behavior, and record any remaining investigation or recovery work. A change ticket marked complete should state what was checked.
Avoid unsupported attribution and deadlines
This review does not substantiate the earlier article’s count of breached federal agencies, universal 48-hour deadline or detailed victim impacts. Use the directive’s current text for agency requirements and its dated supplemental instructions for specific actions. Do not apply a historical deadline as a new deadline for every private business.
Questions for the incident owner
- Does the inventory cover every relevant appliance and service?
- Has each device been mapped to its own advisory and supported upgrade path?
- Is there evidence of compromise requiring recovery beyond a software update?
- Who has authority to approve disruption and coordinate remote-access continuity?
- What evidence shows the remediation worked, and what investigation remains open?
🚨 ENTERPRISE APT DEFENSE DIRECTIVE:
To combat sophisticated nation-state actors and geopolitical cyber espionage across your enterprise infrastructure, continuous monitoring is critical. Explore verified defensive blueprints, real-time IOCs, and zero-trust mitigation architectures within our canonical intelligence repository: The 2026 Nation-State APT & Cyber Security Threat Monitoring Vault.
For related context, see our nation-state and APT threat guide.
Correction: Corrected CVE descriptions and scores, removed unsupported victim counts and quotations, and clarified directive scope. Current vendor instructions take precedence over this historical overview.
